Conventional Changelog Core experienced a minor update with the release of version 1.9.2, succeeding version 1.9.1. Both versions serve as the core for generating conventional changelogs, automating the process of creating changelogs from commit messages adhering to the conventional commits specification. This structured approach ensures consistency and readability, making it easier for developers to track changes and understand the evolution of a project.
Key dependencies like q, lodash, read-pkg, through2, dateformat, read-pkg-up, get-pkg-repo, git-raw-commits, conventional-commits-parser and conventional-changelog-writer remain largely consistent between the two versions, indicating a focus on stability and backward compatibility. A subtle difference can be noticed in the git-semver-tags dependency, upgraded from version 1.2.1 to 1.2.2, potentially incorporating bug fixes or minor enhancements related to semantic version tag handling within Git repositories.
Furthermore, the conventional-changelog-angular dev dependency undergoes a minor version bump from 1.5.0 to 1.5.1. This suggests improvements or fixes specific to the angular preset used with conventional changelog, possibly aligning better with newer angular conventions.
For developers, this update signifies a stable and reliable tool reinforced with minor enhancements. The core functionality remains unchanged, ensuring a smooth transition for existing users. The updated dependencies suggest refinements in handling both Git-related functionalities and angular-specific changelog generation, leading to improved accuracy and compatibility for projects leveraging those aspects. The update provides a refined and dependable conventional changelog experience.
All the vulnerabilities related to the version 1.9.2 of the package
Uncontrolled Resource Consumption in trim-newlines
@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
dot-prop Prototype Pollution vulnerability
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
